How can I display my SSN id in the ASP web page with PCI standards

Question

In my ASP web page I am displaying SSN number

" name ="txtSSNID" size ="20">

The Fortify Developer tool detects this as error. How can I fix this issue.

I need to display the SSN Number but the thing is it should not caught while testing in Fortify developer tool for security violations

Answer 1

I am not sure exactly what you want? but like Creidt card numbers cant you just show few 'X' and the last few letters?

Answer 2

Michael,

There are a few ways you can deal with this problem:

1. Talk to your product manager and arrange for an exception from PCI compliance, or get approval from him to apply an output mask to this data. Like replace 123-11-1234 with 12X-XX-XXXX for display.

2. If you do need to display the value, use SSL and request the user's login credentials a second time immediately before showing the SSN.

3. If you really need to make Fortify stop displaying the error, you can click on the red X in Fortify Audit Workbench to suppress the finding. For this you are going to want to obtain approval from your security auditor.